Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 12:53
Static task
static1
Behavioral task
behavioral1
Sample
9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe
-
Size
236KB
-
MD5
557bcc59ab20c44eb5b84c5073199983
-
SHA1
52d573e3d68459bfbb728510db9c7e564fcb1bbb
-
SHA256
9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c
-
SHA512
e5264c9aa5a445df6848f48d6eaa8acc3173848ddab34ab641308f2ec34a2905894c953ed2c9bed3078aea9d39ab3d77bacd728db7941073c4966978f64f13a2
-
SSDEEP
6144:XqqDLuj88h5Acbv98/V4+a0hu3Z6dY5y:6qnuo877bFm48huYY
Malware Config
Extracted
Family
netwire
C2
atlaswebportal.zapto.org:4000
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
R5_04.08.16
-
keylogger_dir
C:\NVIDIA\profile\
-
lock_executable
false
-
offline_keylogger
true
-
password
Micr0s0ft4456877
-
registry_autorun
false
-
use_mutex
false
Extracted
Family
latentbot
C2
atlaswebportal.zapto.org
Signatures
-
NetWire RAT payload 4 IoCs
resource yara_rule behavioral2/memory/1852-3-0x0000000000400000-0x000000000041F000-memory.dmp netwire behavioral2/memory/1852-5-0x0000000000400000-0x000000000041F000-memory.dmp netwire behavioral2/memory/1852-10-0x0000000000400000-0x000000000041F000-memory.dmp netwire behavioral2/memory/1852-14-0x0000000076680000-0x0000000076770000-memory.dmp netwire -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92 PID 1720 wrote to memory of 1852 1720 9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe"C:\Users\Admin\AppData\Local\Temp\9865e9f4989142513108fb6e783aa0b14528af46cc77f846e6a206c6362b0e7c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:1852
-